A method for recording and real-time playback of presentation layer protocol data includes the step of intercepting, by a recorder, a presentation layer protocol data stream comprising a plurality of packets, during transmission of the presentation layer protocol data stream from a first device to a second device, the presentation layer protocol data stream representing display data. A distributor transmits a copy of at least one packet of the presentation layer protocol data stream. A protocol engine uses information associated with the at least one copied packet to regenerate the display data represented by the at least one copied packet. The steps of intercepting the presentation layer protocol data stream and of transmitting the copy of the at least one packet repeat until the first device completes transmission of the protocol data stream to the second device.